CVE-2021-4343

The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stm_listing_register AJAX action function being accessible and taking roles unprotected. This makes it possible for unauthenticated attackers to create accounts, even those with administrator privileges.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/Exploit
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6bf45b-b02d-43bb-b682-7f1ae994e1d3?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/Exploit
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6bf45b-b02d-43bb-b682-7f1ae994e1d3?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43415HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, an…8.8
• CVE-2021-43419An Information Disclosure vulnerability exists in Opay Mobil…7.5
• CVE-2021-4342Rejected reason: CVE split into individual CVE IDs for each …
• CVE-2021-43420SQL injection vulnerability in Login.php in Sourcecodester O…9.8
• CVE-2021-43421A File Upload vulnerability exists in Studio-42 elFinder 2.0…9.8
• CVE-2021-43429A Denial of Service vulnerability exists in CORTX-S3 Server …7.5
• CVE-2021-43430An Access Control vulnerability exists in BigAntSoft BigAnt …8.8
• CVE-2021-43432A Cross Site Scripting (XSS) vulnerability exists in Exrick …6.1
• CVE-2021-43436MartDevelopers Inc iResturant v1.0 allows Stored XSS by plac…5.4
• CVE-2021-43437In sourcecodetester Engineers Online Portal as of 10-21-21, …8.8
• CVE-2021-43438Stored XSS in Signup Form in iResturant 1.0 Allows Remote At…5.4
• CVE-2021-43439RCE in Add Review Function in iResturant 1.0 Allows remote a…9.8